diff --git a/.github/workflows/fetch-upstream-mods.yml b/.github/workflows/fetch-upstream-mods.yml
index 0b073262..206f4f6f 100644
--- a/.github/workflows/fetch-upstream-mods.yml
+++ b/.github/workflows/fetch-upstream-mods.yml
@@ -33,18 +33,34 @@ jobs:
           done
 
       - name: Commit and push
+        env:
+          GITEA_TOKEN: ${{ secrets.GT_TOKEN }}
         run: |
           cd repo
+
           git config user.name 'jim[bot]'
           git config user.email 'jim[bot]@users.noreply.github.com'
-          git config lfs.locksverify false
 
-          git remote set-url origin \
-            http://${GITEA_TOKEN}@smallgit.dasguney.com:3000/skyline/balatro-mod-index.git
+          # Provide HTTP Basic auth to libcurl (works for git + git-lfs), token as PASSWORD
+          cat > ~/.netrc <<EOF
+      machine smallgit.dasguney.com
+      login skyline
+      password ${GITEA_TOKEN}
+      EOF
+          chmod 600 ~/.netrc
+
+          # Use direct Gitea HTTP endpoint (no nginx)
+          git remote set-url origin http://smallgit.dasguney.com:3000/skyline/balatro-mod-index.git
+
+          # Force git-lfs to use the same endpoint (otherwise it keeps using https://smallgit...)
+          git config lfs.url "http://smallgit.dasguney.com:3000/skyline/balatro-mod-index.git/info/lfs"
+          git config lfs."http://smallgit.dasguney.com:3000/skyline/balatro-mod-index.git/info/lfs".locksverify false
+
+          # If LFS hooks exist, make sure they're installed consistently
+          git lfs install --local || true
 
           git add mods
           if git commit -m "fetch upstream mod changes ($(date --utc +%Y%m%d_%H%M%SZ))"; then
             git push origin main
           fi
-        env:
-          GITEA_TOKEN: ${{ secrets.GT_TOKEN }}
+